<?xml version="1.0" encoding="UTF-8"?><xml><records><record><source-app name="Biblio" version="6.x">Drupal-Biblio</source-app><ref-type>10</ref-type><contributors><authors><author><style face="normal" font="default" size="100%">Mark Allman</style></author><author><style face="normal" font="default" size="100%">Ethan Blanton</style></author><author><style face="normal" font="default" size="100%">Vern Paxson</style></author><author><style face="normal" font="default" size="100%">Scott Shenker</style></author></authors></contributors><titles><title><style face="normal" font="default" size="100%">Fighting coordinated attackers with cross-organizational information sharing</style></title><secondary-title><style face="normal" font="default" size="100%">HotNets V</style></secondary-title><tertiary-title><style face="normal" font="default" size="100%">Proceedings of The Fifth Workshop on Hot Topics in Networks (HotNets '06)</style></tertiary-title></titles><dates><year><style  face="normal" font="default" size="100%">2006</style></year><pub-dates><date><style  face="normal" font="default" size="100%">11/2006</style></date></pub-dates></dates><urls><web-urls><url><style face="normal" font="default" size="100%">http://www.icir.org/vern/papers/info-sharing-hotnet06.pdf</style></url></web-urls></urls><publisher><style face="normal" font="default" size="100%">ACM</style></publisher><pub-location><style face="normal" font="default" size="100%">Irvine, CA</style></pub-location><pages><style face="normal" font="default" size="100%">121-126</style></pages><abstract><style face="normal" font="default" size="100%">In this paper we propose an architecture for using cross organization information sharing to identify members of 
a group of hosts enslaved for malicious purposes on the Internet. We root our system in so-called “detectives”— 
savvy network monitors like sophisticated intrusion detection systems or honeyfarms that have a deep understanding of malicious behavior. We augment information from these detectives with observations from a large array of “witnesses” that are already in-place at many locations in the network. These witnesses are not savvy enough to understand that a particular behavior is malicious, but their simple factual observations can be shared with a detective in order to form a broad picture of a group of bad actors. A key aspect of the system is the design of a lightweight mechanism to reliably share enough information between detectives and witnesses to form an understanding of a group of bad actors without sharing more information than necessary, in order to address privacy and competitive concerns.</style></abstract></record></records></xml>